[Bug 1850548] New: sssd not renewing/obtaining krb ticket at login
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1850548
Bug ID: 1850548
Summary: sssd not renewing/obtaining krb ticket at login
Product: Fedora
Version: 32
Status: NEW
Component: sssd
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: gwync(a)protonmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
mzidek(a)redhat.com, pbrezina(a)redhat.com,
rharwood(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Prior to f32, my sssd/krb5 setup allowed login and ensured a current krb5
ticket at login. With f32 it allows login but doesn't obtain or renew a ticket.
Manual kinit works fine after login. The only error I see in the logs at the
moment at login time is:
[dp_target_run_constructor] (0x0010): Target [resolver] constructor failed
[95]: Operation not supported
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
3 years, 8 months
[Bug 1648521] Regression: sssd sssd-2.0.0-4 slows down autofs - 'getautomntent_r: Invalid argument'
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1648521
--- Comment #29 from W. Michael Petullo <mike(a)flyn.org> ---
I found this fixed with Fedora 32. I use Kerberos for authentication and
LDAP/NFS/autofs for home directories. Has anyone else had luck?
I configured my host with `authselect select sssd --force`.
The result, which seems to work fine, follows:
# Generated by authselect on Fri Jun 19 16:36:27 2020
# Do not modify this file manually.
# If you want to make changes to nsswitch.conf please modify
# /etc/authselect/user-nsswitch.conf and run 'authselect apply-changes'.
#
# Note that your changes may not be applied as they may be
# overwritten by selected profile. Maps set in the authselect
# profile takes always precedence and overwrites the same maps
# set in the user file. Only maps that are not set by the profile
# are applied from the user file.
#
# For example, if the profile sets:
# passwd: sss files
# and /etc/authselect/user-nsswitch.conf contains:
# passwd: files
# hosts: files dns
# the resulting generated nsswitch.conf will be:
# passwd: sss files # from profile
# hosts: files dns # from user file
passwd: sss files systemd
group: sss files systemd
netgroup: sss files
automount: sss files
services: sss files
# Included from /etc/authselect/user-nsswitch.conf
#
# /etc/nsswitch.conf
#
# Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# Valid databases are: aliases, ethers, group, gshadow, hosts,
# initgroups, netgroup, networks, passwd, protocols, publickey,
# rpc, services, and shadow.
#
# Valid service provider entries include (in alphabetical order):
#
# compat Use /etc files plus *_compat pseudo-db
# db Use the pre-processed /var/db files
# dns Use DNS (Domain Name Service)
# files Use the local files in /etc
# hesiod Use Hesiod (DNS) for user lookups
# nis Use NIS (NIS version 2), also called YP
# nisplus Use NIS+ (NIS version 3)
#
# See `info libc 'NSS Basics'` for more information.
#
# Commonly used alternative service providers (may need installation):
#
# ldap Use LDAP directory server
# myhostname Use systemd host names
# mymachines Use systemd machine names
# mdns*, mdns*_minimal Use Avahi mDNS/DNS-SD
# resolve Use systemd resolved resolver
# sss Use System Security Services Daemon (sssd)
# systemd Use systemd for dynamic user option
# winbind Use Samba winbind support
# wins Use Samba wins support
# wrapper Use wrapper module for testing
#
# Notes:
#
# 'sssd' performs its own 'files'-based caching, so it should generally
# come before 'files'.
#
# WARNING: Running nscd with a secondary caching service like sssd may
# lead to unexpected behaviour, especially with how long
# entries are cached.
#
# Installation instructions:
#
# To use 'db', install the appropriate package(s) (provide 'makedb' and
# libnss_db.so.*), and place the 'db' in front of 'files' for entries
# you want to be looked up first in the databases, like this:
#
# passwd: db files
# shadow: db files
# group: db files
# In order of likelihood of use to accelerate lookup.
shadow: files sss
hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname
aliases: files
ethers: files
gshadow: files
# Allow initgroups to default to the setting for group.
# initgroups: files
networks: files dns
protocols: files
publickey: files
rpc: files
--
You are receiving this mail because:
You are the assignee for the bug.
3 years, 10 months
[Bug 1849109] New: 'System error' on login with domain account after system update (online login only)
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1849109
Bug ID: 1849109
Summary: 'System error' on login with domain account after
system update (online login only)
Product: Fedora
Version: 32
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Severity: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: vargax(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
mzidek(a)redhat.com, pbrezina(a)redhat.com,
rharwood(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com
Target Milestone: ---
Group: private
Classification: Fedora
Created attachment 1698118
--> https://bugzilla.redhat.com/attachment.cgi?id=1698118&action=edit
update logs and journalctl output
Description of problem:
Online login with a domain account is broken after a full update on a Fedora 32
system joined to an Active Directory domain using realm. Offline login (using
cached credentials) works. kinit also works.
Version-Release number of selected component (if applicable):
How reproducible:
Allways
Steps to Reproduce:
1. Install Fedora 32
2. Join system to AD domain using realm
3. Login with a domain account > Login works
4. Full update the system
5. Try to login with a domain account > Login Fails > System Error
6. Disconnect network
7. Try to login with domain account > Login works
Actual results:
Online login with domain account fails
Expected results:
Online login with domain account should works
Additional info:
Full update log and journalctl logs attached
Steps ran on a vanilla Fedora 32 Workstation VM:
[ws@localhost-live ~]$ sudo su
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
[sudo] password for ws:
[root@localhost-live ws]# cd
[root@localhost-live ~]# hostnamectl set-hostname --static test-f32-wrks
[root@localhost-live ~]# realm join -v --user=cvargasc ad.activarsas.co
* Resolving: _ldap._tcp.ad.activarsas.co
* Performing LDAP DSE lookup on: 10.11.11.98
* Successfully discovered: ad.activarsas.co
Password for cvargasc:
* Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir,
/usr/sbin/sssd, /usr/sbin/adcli
* LANG=C /usr/sbin/adcli join --verbose --domain ad.activarsas.co
--domain-realm AD.ACTIVARSAS.CO --domain-controller 10.11.11.98 --login-type
user --login-user cvargasc --stdin-password
* Using domain name: ad.activarsas.co
* Calculated computer account name from fqdn: TEST-F32-WRKS
* Using domain realm: ad.activarsas.co
* Sending NetLogon ping to domain controller: 10.11.11.98
* Received NetLogon info from: scandelaria.ad.activarsas.co
* Wrote out krb5.conf snippet to
/var/cache/realmd/adcli-krb5-MkTsc9/krb5.d/adcli-krb5-conf-IqiLw8
* Authenticated as user: cvargasc(a)AD.ACTIVARSAS.CO
* Using GSS-SPNEGO for SASL bind
* Looked up short domain name: AD
* Looked up domain SID: S-1-5-21-490755958-958459292-2945111038
* Using fully qualified name: test-f32-wrks
* Using domain name: ad.activarsas.co
* Using computer account name: TEST-F32-WRKS
* Using domain realm: ad.activarsas.co
* Calculated computer account name from fqdn: TEST-F32-WRKS
* Generated 120 character computer password
* Using keytab: FILE:/etc/krb5.keytab
* Found computer account for TEST-F32-WRKS$ at:
CN=TEST-F32-WRKS,CN=Computers,DC=ad,DC=activarsas,DC=co
* Sending NetLogon ping to domain controller: 10.11.11.98
* Received NetLogon info from: scandelaria.ad.activarsas.co
* Set computer password
* Retrieved kvno '3' for computer account in directory:
CN=TEST-F32-WRKS,CN=Computers,DC=ad,DC=activarsas,DC=co
* Checking host/TEST-F32-WRKS
* Added host/TEST-F32-WRKS
* Checking RestrictedKrbHost/TEST-F32-WRKS
* Added RestrictedKrbHost/TEST-F32-WRKS
* Discovered which keytab salt to use
* Added the entries to the keytab: TEST-F32-WRKS$(a)AD.ACTIVARSAS.CO:
FILE:/etc/krb5.keytab
* Added the entries to the keytab: host/TEST-F32-WRKS(a)AD.ACTIVARSAS.CO:
FILE:/etc/krb5.keytab
* Added the entries to the keytab:
RestrictedKrbHost/TEST-F32-WRKS(a)AD.ACTIVARSAS.CO: FILE:/etc/krb5.keytab
* /usr/bin/systemctl enable sssd.service
* /usr/bin/systemctl restart sssd.service
* /usr/bin/sh -c /usr/bin/authselect select sssd with-mkhomedir --force &&
/usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start
oddjobd.service
Backup stored at /var/lib/authselect/backups/2020-06-19-15-17-49.nmhfmX
Profile "sssd" was selected.
The following nsswitch maps are overwritten by the profile:
- passwd
- group
- netgroup
- automount
- services
Make sure that SSSD service is configured and enabled. See SSSD documentation
for more information.
- with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module
is present and oddjobd service is enabled and active
- systemctl enable --now oddjobd.service
Created symlink /etc/systemd/system/multi-user.target.wants/oddjobd.service →
/usr/lib/systemd/system/oddjobd.service.
* Successfully enrolled machine in realm
[root@localhost-live ~]# sed -i 's&%u@%d&%u&g' /etc/sssd/sssd.conf
[root@localhost-live ~]# sed -i 's&use_fully_qualified_names =
True&use_fully_qualified_names = False&g' /etc/sssd/sssd.conf
[root@localhost-live ~]# cat >> /etc/sssd/sssd.conf <<EOF
> auto_private_groups = true
> EOF
[root@localhost-live ~]# systemctl restart sssd.service
[root@localhost-live ~]# echo "%domain\ admins ALL=(ALL) ALL" >
/etc/sudoers.d/domain-admins
[root@localhost-live ~]# exit
exit
[ws@localhost-live ~]$ su cvargasc
Password:
[cvargasc@test-f32-wrks ws]$ cd
[cvargasc@test-f32-wrks ~]$ sudo dnf update
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
[sudo] password for cvargasc:
(...full update log attached...)
Complete!
[cvargasc@test-f32-wrks ~]$ exit
exit
[ws@localhost-live ~]$ su cvargasc
Password:
su: System error
[ws@localhost-live ~]$ nmcli connection down Wired\ connection\ 1
Connection 'Wired connection 1' successfully deactivated (D-Bus active path:
/org/freedesktop/NetworkManager/ActiveConnection/1)
[ws@localhost-live ~]$ su cvargasc
Password:
[cvargasc@test-f32-wrks ws]$ exit
[ws@localhost-live ~]$ nmcli connection up Wired\ connection\ 1
Connection successfully activated (D-Bus active path:
/org/freedesktop/NetworkManager/ActiveConnection/2)
[ws@localhost-live ~]$ su lpguerreroj
Password:
su: System error
[ws@localhost-live ~]$ nmcli connection down Wired\ connection\ 1
Connection 'Wired connection 1' successfully deactivated (D-Bus active path:
/org/freedesktop/NetworkManager/ActiveConnection/1)
[ws@localhost-live ~]$ su lpguerreroj
Password:
[lpguerreroj@test-f32-wrks ws]$
--
You are receiving this mail because:
You are the assignee for the bug.
3 years, 10 months
[Bug 1648521] Regression: sssd sssd-2.0.0-4 slows down autofs - 'getautomntent_r: Invalid argument'
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1648521
--- Comment #28 from rob.verduijn(a)gmail.com ---
Hello all,
I've got weird autofs/sssd errors as well.
I still have them with a centos8.2 ipa server using a fedora32 ipaclient.
I've build a reproducer in vagrant.
To use it, install vagrant on a fedora32 host.
Configure the host for kvm virtualization.
create an empty directory,
- mkdir vagrant
put the Vagrant script in that dir
cd to that dir
check the script if the DOMAIN_URI var is ok
give the command : vagrant up
wait for a long time for the script to finish
when the script is finished:
log in to the fedoraclient with vagrant:
vagrant ssh fedoraclient
become root:
sudo -i
check to see if the home directory is mounted:
mount
it will claim to be active
however a directory listing will show the home folder of the user test is
missing:
ls -als /home
restart autofs:
systemctl restart autofs
and now the home dir is mounted, list the home dir:
ls -als /home
and you will see the test user home dir.
if for some reason the mount is working the first time, run the reproducer
script as root
/root/reproducer.sh
and try again after the reboot.
Cheers
Rob
--
You are receiving this mail because:
You are the assignee for the bug.
3 years, 10 months
[Bug 1615701] Authentication failed if I type in the wrong password once
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1615701
Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo
| |raproject.org
--- Comment #12 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> ---
This package has changed maintainer in the Fedora.
Reassigning to the new maintainer of this component.
--
You are receiving this mail because:
You are the assignee for the bug.
3 years, 10 months
[Bug 1785229] Auth fails with "Could not start TLS encryption. unknown error"
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1785229
Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo
| |raproject.org
--- Comment #19 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> ---
This package has changed maintainer in the Fedora.
Reassigning to the new maintainer of this component.
--
You are receiving this mail because:
You are the assignee for the bug.
3 years, 10 months
[Bug 1676961] sss_cache ignores effective uid
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1676961
Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo
| |raproject.org
--- Comment #3 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> ---
This package has changed maintainer in the Fedora.
Reassigning to the new maintainer of this component.
--
You are receiving this mail because:
You are the assignee for the bug.
3 years, 10 months
[Bug 1669607] sssd: sssd-kcm does not appear to expire Kerberos tickets
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1669607
Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo
| |raproject.org
--- Comment #9 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> ---
This package has changed maintainer in the Fedora.
Reassigning to the new maintainer of this component.
--
You are receiving this mail because:
You are the assignee for the bug.
3 years, 10 months